1 files changed, 17 insertions, 21 deletions

diff --git a/src/lib/libcrypto/man/CMS_verify.3 b/src/lib/libcrypto/man/CMS_verify.3
index 5b17a75ca0..ae489933de 100644
--- a/src/lib/libcrypto/man/CMS_verify.3
+++ b/src/lib/libcrypto/man/CMS_verify.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: CMS_verify.3,v 1.4 2019/08/11 12:46:38 schwarze Exp $
+.\" $OpenBSD: CMS_verify.3,v 1.5 2019/08/18 12:06:51 schwarze Exp $
 .\" full merge up to: OpenSSL 35fd9953 May 28 14:49:38 2019 +0200
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 11 2019 $
+.Dd $Mdocdate: August 18 2019 $
 .Dt CMS_VERIFY 3
 .Os
 .Sh NAME
@@ -72,11 +72,10 @@
 .Fc
 .Sh DESCRIPTION
 .Fn CMS_verify
-verifies a CMS SignedData structure.
-.Fa cms
-is the
-.Vt CMS_ContentInfo
-structure to verify.
+verifies the CMS
+.Vt SignedData
+structure
+.Fa cms .
 .Fa certs
 is a set of certificates in which to search for the signing
 certificate(s).
@@ -90,10 +89,6 @@ The content is written to
 if it is not
 .Dv NULL .
 .Pp
-.Fa flags
-is an optional set of flags, which can be used to modify the verify
-operation.
-.Pp
 .Fn CMS_get0_signers
 retrieves the signing certificate(s) from
 .Fa cms .
@@ -105,11 +100,8 @@ Normally the verify process proceeds as follows.
 .Pp
 Initially some sanity checks are performed on
 .Fa cms .
-The type of
-.Fa cms
-must be SignedData.
-There must be at least one signature on the data and if the content is
-detached;
+There must be at least one signature on the data.
+If the content is detached,
 .Fa indata
 cannot be
 .Dv NULL .
@@ -126,7 +118,8 @@ If any signing certificate cannot be located, the operation fails.
 .Pp
 Each signing certificate is chain verified using the
 .Sy smimesign
-purpose and the supplied trusted certificate store.
+purpose and the supplied trusted certificate
+.Fa store .
 Any internal certificates in the message are used as untrusted CAs.
 If CRL checking is enabled in
 .Fa store ,
@@ -142,9 +135,9 @@ and the signature is checked.
 .Pp
 If all signatures verify correctly, then the function is successful.
 .Pp
-Any of the following flags (OR'ed together) can be passed in the
+Any of the following
 .Fa flags
-parameter to change the default verify behaviour:
+(OR'ed together) can be passed to change the default verify behaviour:
 .Bl -tag -width Ds
 .It Dv CMS_NOINTERN
 Do not use the certificates in the message itself when
@@ -156,7 +149,7 @@ parameter.
 If CRL checking is enabled in
 .Fa store ,
 then any CRLs in the message itself are ignored.
-It Dv CMS_TEXT
+.It Dv CMS_TEXT
 MIME headers for type text/plain are deleted from the content.
 If the content is not of type text/plain, an error is returned.
 .It Dv CMS_NO_SIGNER_CERT_VERIFY
@@ -199,7 +192,7 @@ However since the signing time is supplied by the signer it cannot be
 trusted without additional evidence (such as a trusted timestamp).
 .Sh RETURN VALUES
 .Fn CMS_verify
-returns 1 for a successful verification or zero if an error occurred.
+returns 1 for a successful verification or 0 if an error occurred.
 .Pp
 .Fn CMS_get0_signers
 returns all signers or
@@ -210,6 +203,9 @@ The error can be obtained from
 .Xr ERR_get_error 3 .
 .Sh SEE ALSO
 .Xr CMS_sign 3
+.Sh STANDARDS
+RFC 5652: Cryptographic Message Syntax (CMS),
+section 5.1: SignedData Type
 .Sh HISTORY
 These functions first appeared in OpenSSL 0.9.8h
 and have been available since